From 120724bc6d1c2f8c029e67bd91335b48c243404c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 25 Aug 2023 09:32:25 +0100 Subject: [PATCH] tools: fix VMSA construction with explicit CPU family/model/stepping MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If the CPU family/model/stepping are provided on the command line, but the firmware is being automatically extracted from the libvirt guest, we try to build the VMSA too early. This leads to an exception trying to parse the firmware that has not been loaded yet. We must delay building the VMSA in that scenario. Reviewed-by: Peter Krempa Reviewed-by: Erik Skultety Signed-off-by: Daniel P. Berrangé --- tools/virt-qemu-sev-validate | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/tools/virt-qemu-sev-validate b/tools/virt-qemu-sev-validate index c279741004..67edbd085f 100755 --- a/tools/virt-qemu-sev-validate +++ b/tools/virt-qemu-sev-validate @@ -940,7 +940,7 @@ class LibvirtConfidentialVM(ConfidentialVM): "kernel/initrd/cmdline not provided but kernel " "measurement is enabled") - def load_domain(self, uri, id_name_uuid, secure, ignore_config): + def load_domain(self, uri, id_name_uuid, build_vmsa, secure, ignore_config): self.conn = libvirt.open(uri) remote = socket.getfqdn() != self.conn.getHostname() @@ -1049,7 +1049,7 @@ class LibvirtConfidentialVM(ConfidentialVM): capsxml = self.conn.getCapabilities() capsdoc = etree.fromstring(capsxml) - if self.is_sev_es() and self.vmsa_cpu0 is None: + if self.is_sev_es() and build_vmsa: if secure: raise InsecureUsageException( "Using CPU SKU from capabilities is not secure") @@ -1263,17 +1263,19 @@ def attest(args): if args.vmsa_cpu1 is not None: cvm.load_vmsa_cpu1(args.vmsa_cpu1) + if args.domain is not None: + build_vmsa = args.vmsa_cpu0 is None and args.cpu_family is None + cvm.load_domain(args.connect, + args.domain, + build_vmsa, + not args.insecure, + args.ignore_config) + if args.cpu_family is not None: cvm.build_vmsas(args.cpu_family, args.cpu_model, args.cpu_stepping) - if args.domain is not None: - cvm.load_domain(args.connect, - args.domain, - not args.insecure, - args.ignore_config) - cvm.attest() if not args.quiet: print("OK: Looks good to me")